In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf

Part of the recommendations for site owners is the publication of a disclosure policy, in a public area, to state the company's position in terms of reaction to security researchers. I drafted a Vulnerability Disclosure Policy based on the New Zealand Registry Services' policy here: https://nzrs.net.nz/about/vulnerability-disclosure-policy

My employer is in retail, and the managing director doesn't want to publish this on the website, for fear of frightening customers off our website. As a partial solution, we agreed to insert references to the document as comments in our website's source code, as well as in the HTTP headers on our webserver.

Are these enough? Are there any other places we should publish which won't be visible to our average visitor, but WILL be visible to those who should see this policy?

  • I don't recall which rfc recommends it, but domain.com/security is a good place to publish information. – wireghoul May 18 '15 at 3:54
  • Post am email address somewhere for security related questions. Most emails will be support questions but it'll give contact info to those who need it. Just forward the support emails to support. – Neil Smithline May 18 '15 at 4:21
  • "the managing director doesn't want to publish this on the website for fear of frighting customers off our website". Depending on the customers, it might earn you more trust if you are open to the vulnerability disclosures. For a long period of time, all the big vendors were afraid for the exact same reason. But at the end they have to embrace this. – void_in May 18 '15 at 4:29
  • @void_in - yeah, I had that discussion :) Though we do tend towards the "better to not mention it" camp of customers. Generally not tech-savvy, to the point that admitting a possibility of vulnerability would be tantamount to a declaration of utter insecurity. :/ – Rhyven May 18 '15 at 4:34
  • Since you asked for 'hidden' areas, I would suggest considering robots.txt and humans.txt. – amccormack May 20 '15 at 22:39

In seeking an answer to this question, I approached the team at the CROW lab (Cybersecurity Researchers of Waikato). A representative of the Lab responded with the following:

If someone does find a vulnerability, chances are they would be a tech savvy person who would have looked at the HTML or HTTP headers. I believe that it is enough for an average security researcher to find (looking at it from a technical view not legal view of course).

So, until any further information comes to light, I'm accepting that as the answer; I'll still appreciate additional answers though!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.